Data Linked/Not Linked to You classifications are correct
Why it matters
The Linked/Not Linked classification is one of Apple's most scrutinised nutrition label fields. Declaring analytics as 'Data Not Linked to You' while calling setUserId(), identify(), or Sentry.setUser() misrepresents your data practices to every user who reads your App Store listing. Under GDPR Art.13 and Art.4(1), data is 'personal' the moment it can be linked to an identifiable person — calling setUserId() crosses that threshold and obligates accurate disclosure. Apple reviews this classification both during initial review and in response to user-filed reports.
Severity rationale
Low because the mis-classification is a disclosure error rather than a data breach, but it creates cumulative legal and reputational risk when discovered during enforcement.
Remediation
Audit every analytics call site for whether a user identifier is passed. Any call to setUserId(), identify(), alias(), Sentry.setUser(), or equivalent makes the corresponding data type 'Linked to You.'
If you want crash data classified as 'Not Linked to You', strip user IDs and emails before SDK initialisation:
// Do not pass user context to crash reporter
Sentry.init({ dsn: '...' }); // no setUser() call
Update your App Store nutrition labels and privacy policy to reflect the actual linkage. If users are logged in and analytics tracks their actions, the data is linked — no amount of internal anonymisation changes the classification if the link exists at ingestion.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — Information to be provided where personal data are collected from the data subject
- gdpr · Art. 4(1) — Definition of personal data and identifiability
- ccpa · §1798.100 — Right to know about personal information collected
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated